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^^^.^^t.>nth«cldtns (flris listing replaces all prior versions): 

1 (cmrently amended) A method comprising: 
detcctmg[[a]]possiblesecurity^eMe«mobl^ 

transmittingnoticeof Ihepossiblesecuritypiebk^mQb^ anet^oricmteal 

time to ahomelocatlonremotelylocatedfromthecUentleeatieHlscte 

detemnning at Ihehomelocationan anomaly based on at least thepossiW^ 

^^^^ ^^oainfom.i uulU. Che liunn I f 1> '■"^^ ^ ^ ^" ^ "^^""^ 

^ansmittingnoticeoftheanamalyinrealtimetothecKentlee^lQ^ 
the possible security pfebl^ prot?]epis j»i&.detectedLaBd 

2 (original) Themethodof claiml ftrthcrcomprisingtransmittingnoti^ 
anomalymrealtime to other cUent locations that may comm^micatewith^^ 

fhenetworic. 

3. (cancelled) 

4. (original) Hie methtni of claim 1 further comprising inspecting a packet ihat 
arrives at the cUent location to detect the possible security problem. 

5 (currently amended) The method of claim 1 in^hichthe n ut ..oAiPohid n> H. 

private fietw«k networks. 

6. (original) Themethod of claim 1 in vAichthe anomaly includes nnanthorized 
access to fhe network. 

7. (original) The method of claim 1 in which the anomaly includes unauthorized 
access of aresoince accessible through the network. 
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ofresources available through the netwoik. 

0 (ciBreotly amended) An article comprising: 
amachiB^readablemediumwMchcontainsmachi^ 

instructions causing amaduneio: __^^.i^,^trraii cUentleea^ locations; 

detect [[all possible seamtyp*eWe»P!»EaS- . 

ti^etoahomelocationremotelylocatedftomthccU-ttleee^^^ 

deternuneatthchamelocationananomalybasedc«iatlea.tthcpo3S. 

leg ation; a ad . ,^ . a- M w leea^ loMtisas at which 

transmit notice of the anomalymrealtme to the Ghent teeafeOBi^^ 

thepossible security pf0bte^0obto^detected;an^ _«wforthe 
„^,,,.^^ ^^11.« Ihr M init 1 orf ^T ionstn.c c,ppntforthe 

anomaly. 

over the network 

11, (cancelled) 

,2 (c«™tty«»ded)Ttoarfoteofcl»m9ftrt«roa»smg[[.l]a.H»c^ 
i^ap.ck«fl«.-iv«^th»cl».tloc,««todctec.ih.po»bl.s«uriV 

M^.MMs,'.!^^^^ 

private fistwwk networks. 
9CC6SS to the network. 
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15. (c«igii^)Tlie.rticleofcl^9mwhich1heaoomalyinclud. 
access of a resoittce accessible through the network. 

16. (orig^nal)theaxticleofclai.9in^chtheanon.alyincl^^^ 
of resources available through the network. 

17 (currently amended) A method comprising: 



20, (cancelled) 
cUo»tlocatoid«t*poM>le«ce«ityp<>M«>* 
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23-27. (cancelled) 

28. (curtaitly amended) An apparatus comprising: 

rlimtf? ^^.-jr^^rnt for the anomdX- 
anomalies. 

30. (currently amended) A system comprising: 
[[ft]] fvf ^otmore. cUent teiBMafll tg^^l 
B server; 

. w .^Hmssecurityptoblemsthiitfliefirstcfientmedtfinsmmayusem 
the server in real tmie regardmg secuniy proowM» 

detectingpossiblesecuritypioblems; ^.tprmine an anomaly based on at 

afirst server mechanic acce^iT^leby the server to deterinme an anomaly 

,eastlnformationfiom^i....U^^ 



PAGE 6/14'RCVDAT3l2f2006 3:09:45 PMIpastem Standard Tlmej'SVRiUSPTO 



f 



.MAR. 2. 2006 3:.15PM (3) FISH & RICHARDSON 6175428906 NO. 8341 P. 7 

Attotney Docket 10559-4»OUi/PH«'- 

AppUcant : D»vidW. AucsmithetaL 
A^ignce : IntdCoipoiation 

pjjg^ : December 6, 2001 
page : 6 of 13 

, , .,„„. 1 othnriliif 

. i«n.^«»e8siblebyti)e6crv«totransmitnoticeoftbeanomalym 
real time over the network to the client teraaa*™^ 

determined anomaUes. 

coinmumcate with iheserverover the network. 

^^fogSj^includes a corporate server. 
36-38. (cancelled) 

39. (cancelled) 

40. (currently ameaded) A method comprising: 
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41 (an«oay»ne»ded)Am«a«dcotGpii»tag: 

f i> nrr-- "''^"'"T' i^J^^IIluH--. " " 

mi^niaaiig notice of the MKUJUiy »■ 

• .«u, i/>gaftA at the bome location Jprnifimff t^^iiiviM^F. 
„,^rt,itifiMmation previously logged at xnenoiti 



transmitting notice 

43, (cancelled) 

44. (cancelled) 
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addresses associated with aeomtyixoblenB. 

46. ^previousiiy f „„«^5,HMreoorted to the server by the 

„e<*a.^toeoUeot»>d»«n«ini.>«»n«-io.reg»dmg^ 

clients. 

compute and stole (ecoris of monulies. 

48 («„)Tt=methodofddm40,fcra.ercoc.pTtogatl«*o«ofcoB.«tag 

;r:Z:l.* «i.Sa«»..x...«>eo:V.eeH»is.»d=^S^ 

49. (ne«)Then,efl«^ofd»m40.fb*erco,,^sing«on.p»ti.««^s»rin^ 
of aiiomdiestyiistog a statistics medimism 

50. (new)Ttamethodofd.im4U«rt«"^8»Pd«to8.i»'«''*»«-» 
p«,tecting the caem locatkm to »»»a.* the anomaly. 

flre«dlprotectmgthecBeBtlocatio»to.eco«at«.rth=».oi«ly. 



Pi«9n4'RC«D*T3m3«:ISni|EaslraSllllMTIm]'SVIHMO{^ 



MAR. 2.2a06 3:J6PM (3) FISH & RICHARDSON 6175428906 NO. 8341 P. 10 

Attorney Docket: 1055JM63001/P10875 

Applioant : David W.Aucsmitbetal. 
A^iguee : Intel Coipoiatloii 
SerialNo. : 10/010.743 
pjlgij ; Deceniber 6, 2001 
Page : 9 of 13 

location, and alogin ftom an unexpected user. 
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